diff --git a/Dockerfile b/Dockerfile
index 9d80e16..9979ce7 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -54,10 +54,14 @@ RUN apk update \
     && bundle config set jobs $(nproc) \
     && bundle install --gemfile=/Gemfile \
     && rm -rf /usr/local/lib/ruby/gems/*/cache/* \
-    && rm -rf /usr/local/lib/ruby/gems/2.7.0/gems/cgi-0.1.0.2 \
-    && rm -rf /usr/local/lib/ruby/gems/2.7.0/specifications/default/cgi-0.1.0.2.gemspec \
-    && rm -rf /usr/local/lib/ruby/gems/2.7.0/gems/stringio-0.1.0 \
-    && rm -rf /usr/local/lib/ruby/gems/2.7.0/specifications/default/stringio-0.1.0.gemspec
+    && rm -rf /usr/local/lib/ruby/gems/*/gems/cgi-* \
+    && rm -rf /usr/local/lib/ruby/gems/*/specifications/default/cgi-*.gemspec \
+    && rm -rf /usr/local/lib/ruby/gems/*/gems/stringio-* \
+    && rm -rf /usr/local/lib/ruby/gems/*/specifications/default/stringio-*.gemspec \
+    && rm -rf /usr/local/lib/ruby/gems/*/gems/rdoc-* \
+    && rm -rf /usr/local/lib/ruby/gems/*/specifications/default/rdoc-*.gemspec \
+    && rm -rf /usr/local/lib/ruby/gems/*/gems/rexml-* \
+    && rm -rf /usr/local/lib/ruby/gems/*/specifications/rexml-*.gemspec
 
 WORKDIR /repo
 
diff --git a/voxbox/Gemfile b/voxbox/Gemfile
index b710f53..9b6ea34 100644
--- a/voxbox/Gemfile
+++ b/voxbox/Gemfile
@@ -13,6 +13,10 @@ gem 'voxpupuli-release',    ENV['RUBYGEM_VOXPUPULI_RELEASE']
 gem 'voxpupuli-test',       ENV['RUBYGEM_VOXPUPULI_TEST']
 gem 'rubocop-performance',  ENV['RUBYGEM_RUBOCOP_PERFORMANCE']
 gem 'ffi', '~> 1.16.3' # ffi 1.17.0 has change dependencies - see https://github.com/ffi/ffi/issues/1105
-gem 'stringio', '~> 3.1'    # stringio 0.1.0 has CVEs - remove default and install upstream replacement
 
+# CVE fixes
+gem 'cgi', '~> 0.4.1'             # cgi 0.1.0 has CVEs - remove default and install upstream replacement
+gem 'stringio', '~> 3.1'          # stringio 0.1.0 has CVEs - remove default and install upstream replacement
+gem 'rexml', '~> 3.3', '>= 3.3.6' # rexml < 3.3 has CVEs - remove default and install upstream replacement
+gem 'rdoc', '~> 6.7'             # rdoc 6.2.1 has CVEs - remove default and install upstream replacement
 # vim: syntax=ruby